summaryrefslogtreecommitdiffstats
path: root/drivers/usb/gadget
Commit message (Collapse)AuthorAgeFilesLines
...
| * | | Merge tag 'usb-for-v5.3' of ↵Greg Kroah-Hartman2019-07-0111-34/+118
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next Felipe writes: usb: changes for v5.3 merge window The biggest part here is a set of patches removing unnecesary variables from several drivers. Meson-g12a's dwc3 glue implemented IRQ-based OTG/DRD role swap. Qcom's dwc3 glue added support for ACPI, mainly for the AArch64-based SoCs. DWC3 also got support for Intel Elkhart Lake platforms. * tag 'usb-for-v5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (30 commits) usb: dwc3: remove unused @lock member of dwc3_ep struct usb: dwc3: pci: Add Support for Intel Elkhart Lake Devices usb: Replace snprintf with scnprintf in gether_get_ifname usb: gadget: ether: Fix race between gether_disconnect and rx_submit usb: gadget: storage: Remove warning message usb: dwc3: gadget: Add support for disabling U1 and U2 entries usb: gadget: send usb_gadget as an argument in get_config_params doc: dt: bindings: usb: dwc3: Update entries for disabling U1 and U2 usb: dwc3: qcom: Use of_clk_get_parent_count() usb: dwc3: Fix core validation in probe, move after clocks are enabled usb: dwc3: qcom: Improve error handling usb: dwc3: qcom: Start USB in 'host mode' on the SDM845 usb: dwc3: qcom: Add support for booting with ACPI soc: qcom: geni: Add support for ACPI Revert "usb: dwc2: host: Setting qtd to NULL after freeing it" usb: gadget: net2272: remove redundant assignments to pointer 's' usb: gadget: Zero ffs_io_data USB: omap_udc: Remove unneeded variable fotg210-udc: Remove unneeded variable usb: gadget: at91_udc: Remove unneeded variable ...
| | * | usb: Replace snprintf with scnprintf in gether_get_ifnameDaniel M German2019-06-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | snprintf returns the actual length of the buffer created; however, this is not the case if snprintf truncates its parameter. See https://lwn.net/Articles/69419/ for a detailed explanation. The current code correctly handles this case at the expense of extra code in the return statement. scnprintf does returns the actual length of the buffer created making the ?: operator unnecessary in the return statement. This change does not alter the functionality of the code. Signed-off-by: Daniel M German <dmg@turingmachine.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: ether: Fix race between gether_disconnect and rx_submitKiruthika Varadarajan2019-06-181-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On spin lock release in rx_submit, gether_disconnect get a chance to run, it makes port_usb NULL, rx_submit access NULL port USB, hence null pointer crash. Fixed by releasing the lock in rx_submit after port_usb is used. Fixes: 2b3d942c4878 ("usb ethernet gadget: split out network core") Cc: <stable@vger.kernel.org> Signed-off-by: Kiruthika Varadarajan <Kiruthika.Varadarajan@harman.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: storage: Remove warning messageEJ Hsu2019-06-182-6/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change is to fix below warning message in following scenario: usb_composite_setup_continue: Unexpected call When system tried to enter suspend, the fsg_disable() will be called to disable fsg driver and send a signal to fsg_main_thread. However, at this point, the fsg_main_thread has already been frozen and can not respond to this signal. So, this signal will be pended until fsg_main_thread wakes up. Once system resumes from suspend, fsg_main_thread will detect a signal pended and do some corresponding action (in handle_exception()). Then, host will send some setup requests (get descriptor, set configuration...) to UDC driver trying to enumerate this device. During the handling of "set configuration" request, it will try to sync up with fsg_main_thread by sending a signal (which is the same as the signal sent by fsg_disable) to it. In a similar manner, once the fsg_main_thread receives this signal, it will call handle_exception() to handle the request. However, if the fsg_main_thread wakes up from suspend a little late and "set configuration" request from Host arrives a little earlier, fsg_main_thread might come across the request from "set configuration" when it handles the signal from fsg_disable(). In this case, it will handle this request as well. So, when fsg_main_thread tries to handle the signal sent from "set configuration" later, there will nothing left to do and warning message "Unexpected call" is printed. Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: EJ Hsu <ejh@nvidia.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: send usb_gadget as an argument in get_config_paramsAnurag Kumar Vulisha2019-06-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Passing struct usb_gadget * as an extra argument in get_config_params makes gadget drivers to easily update the U1DevExitLat & U2DevExitLat values based on the values passed from the device tree. This patch does the same Signed-off-by: Anurag Kumar Vulisha <anurag.kumar.vulisha@xilinx.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: net2272: remove redundant assignments to pointer 's'Colin Ian King2019-06-181-5/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pointer 's' is being assigned however the pointer is never used with either of these values before it it reassigned much later on. I suspect it was going to be used in the output of the main control registers scnprintf but was omitted. The assignments of 's' to the driver name or the literal string are redundant and can be removed. Addresses-Coverity: ("Unused value") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: Zero ffs_io_dataAndrzej Pietrasiewicz2019-06-181-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In some cases the "Allocate & copy" block in ffs_epfile_io() is not executed. Consequently, in such a case ffs_alloc_buffer() is never called and struct ffs_io_data is not initialized properly. This in turn leads to problems when ffs_free_buffer() is called at the end of ffs_epfile_io(). This patch uses kzalloc() instead of kmalloc() in the aio case and memset() in non-aio case to properly initialize struct ffs_io_data. Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | USB: omap_udc: Remove unneeded variableHariprasad Kelam2019-06-181-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the current implementation omap_udc_stop is always returning -ENODEV. Added changes to return 0 and remove variable status. Issue identified with coccicheck drivers/usb/gadget/udc/omap_udc.c:2106:6-12: Unneeded variable: "status". Return "- ENODEV" on line 2128 Signed-off-by: Hariprasad Kelam <hariprasad.kelam@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | fotg210-udc: Remove unneeded variableHariprasad Kelam2019-06-181-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes below warning reported by coccicheck drivers/usb/gadget/udc/fotg210-udc.c:484:5-8: Unneeded variable: "ret". Return "0" on line 507 Signed-off-by: Hariprasad Kelam <hariprasad.kelam@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: at91_udc: Remove unneeded variableHariprasad Kelam2019-06-181-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | at91_wakeup is always returning -EINVAL. But usb_gadget_wakeup expects 0 on success and negative number on failure. As per current implementation this function wont fail. This patch removes unneeded variable and returns 0. Issue identified by coccicheck drivers/usb/gadget/udc/at91_udc.c:802:6-12: Unneeded variable: "status". Return "- EINVAL" on line 821 Signed-off-by: Hariprasad Kelam <hariprasad.kelam@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: udc: renesas_usb3: Enhance role switch supportBiju Das2019-06-181-7/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The RZ/G2E cat874 board has a type-c connector connected to hd3ss3220 usb type-c drp port controller. Enhance role switch support to assign the role requested by connector device using the usb role switch class framework. Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Biju Das <biju.das@bp.renesas.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: u_audio: Fixed variable declaration coding style issueJonas Stenvall2019-06-181-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixed a coding style issue, replacing unsigned with unsigned int. Reviewed-by: Eugeniu Rosca <erosca@de.adit-jv.com> Signed-off-by: Jonas Stenvall <jonas.stenvall.umea@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| | * | usb: gadget: f_fs: data_len used before properly setFei Yang2019-06-181-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following line of code in function ffs_epfile_io is trying to set flag io_data->use_sg in case buffer required is larger than one page. io_data->use_sg = gadget->sg_supported && data_len > PAGE_SIZE; However at this point of time the variable data_len has not been set to the proper buffer size yet. The consequence is that io_data->use_sg is always set regardless what buffer size really is, because the condition (data_len > PAGE_SIZE) is effectively an unsigned comparison between -EINVAL and PAGE_SIZE which would always result in TRUE. Fixes: 772a7a724f69 ("usb: gadget: f_fs: Allow scatter-gather buffers") Signed-off-by: Fei Yang <fei.yang@intel.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| * | | docs: usb: rename files to .rst and add them to drivers-apiMauro Carvalho Chehab2019-06-203-7/+7
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While there are a mix of things here, most of the stuff were written from Kernel developer's PoV. So, add them to the driver-api book. A follow up for this patch would be to move documents from there that are specific to sysadmins, adding them to the admin-guide. Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Acked-by: Johan Hovold <johan@kernel.org> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | Merge 5.2-rc5 into usb-nextGreg Kroah-Hartman2019-06-172-4/+8
| |\ \ | | | | | | | | | | | | | | | | | | | | We need the USB fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | | usb: remove redundant 'default n' from Kconfig-sBartlomiej Zolnierkiewicz2019-05-211-2/+0
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 'default n' is the default value for any bool or tristate Kconfig setting so there is no need to write it explicitly. Also since commit f467c5640c29 ("kconfig: only write '# CONFIG_FOO is not set' for visible symbols") the Kconfig behavior is the same regardless of 'default n' being present or not: ... One side effect of (and the main motivation for) this change is making the following two definitions behave exactly the same: config FOO bool config FOO bool default n With this change, neither of these will generate a '# CONFIG_FOO is not set' line (assuming FOO isn't selected/implied). That might make it clearer to people that a bare 'default n' is redundant. ... Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* | | Merge tag 'v5.2-rc5' into patchworkMauro Carvalho Chehab2019-06-212-4/+8
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux 5.2-rc5 There are some media fixes on -rc5, so merge from it at media devel tree. * tag 'v5.2-rc5': (210 commits) Linux 5.2-rc5 x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback Smack: Restore the smackfsdef mount option and add missing prefixes ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper() module: Fix livepatch/ftrace module text permissions race tracing/uprobe: Fix obsolete comment on trace_uprobe_create() tracing/uprobe: Fix NULL pointer dereference in trace_uprobe_create() tracing: Make two symbols static tracing: avoid build warning with HAVE_NOP_MCOUNT tracing: Fix out-of-range read in trace_stack_print() gfs2: Fix rounding error in gfs2_iomap_page_prepare x86/kasan: Fix boot with 5-level paging and KASAN timekeeping: Repair ktime_get_coarse*() granularity Revert "ALSA: hda/realtek - Improve the headset mic for Acer Aspire laptops" mm/devm_memremap_pages: fix final page put race PCI/P2PDMA: track pgmap references per resource, not globally lib/genalloc: introduce chunk owners PCI/P2PDMA: fix the gen_pool_add_virt() failure path mm/devm_memremap_pages: introduce devm_memunmap_pages drivers/base/devres: introduce devm_release_action() ...
| * | usb: gadget: udc: lpc32xx: fix return value check in lpc32xx_udc_probe()Wei Yongjun2019-06-061-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In case of error, the function devm_ioremap_resource() returns ERR_PTR() and never returns NULL. The NULL test in the return value check should be replaced with IS_ERR(). This issue was detected by using the Coccinelle software. Fixes: 408b56ca5c8e ("usb: gadget: udc: lpc32xx: simplify probe") Acked-by: Sylvain Lemieux <slemieux.tyco@gmail.com> Acked-by: Vladimir Zapolskiy <vz@mleia.com> Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| * | usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMICAlexandre Belloni2019-06-061-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Gadget drivers may queue request in interrupt context. This would lead to a descriptor allocation in that context. In that case we would hit BUG_ON(in_interrupt()) in __get_vm_area_node. Also remove the unnecessary cast. Acked-by: Sylvain Lemieux <slemieux.tyco@gmail.com> Tested-by: James Grant <jamesg@zaltys.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| * | usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]Young Xiao2019-06-061-0/+5
| |/ | | | | | | | | | | | | | | | | | | There is no deallocation of fusb300->ep[i] elements, allocated at fusb300_probe. The patch adds deallocation of fusb300->ep array elements. Signed-off-by: Young Xiao <92siuyang@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* / media: usb/gadget/f_uvc: set device_caps in struct video_deviceHans Verkuil2019-06-052-4/+1
|/ | | | | | | | | | | | | | | | Instead of filling in the struct v4l2_capability device_caps field, fill in the struct video_device device_caps field. That way the V4L2 core knows what the capabilities of the video device are. But this only really works if all drivers use this, so convert this UVC gadget driver. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Felipe Balbi <felipe.balbi@linux.intel.com> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
* usb: gadget: atmel: tie wake lock to running clockJonas Bonn2019-05-031-0/+4
| | | | | | | | | | | | | | | | | | | | | If the USB device is connected to a host, the CPU cannot be suspended or else the USB device appears to be disconnected from the host's point of view. Only after a "USB suspend" state has been entered (as set by the host) or the host is disconnected can the system safely be suspended: in both these states, the clock is stopped. As such, this patch associates a "wake lock" with the running clock of the UDC to keep the system awake as long as the host maintains the USB connection active. Signed-off-by: Jonas Bonn <jonas@norrbonn.se> CC: Cristian Birsan <cristian.birsan@microchip.com> CC: Felipe Balbi <balbi@kernel.org> CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org> CC: Nicolas Ferre <nicolas.ferre@microchip.com> CC: Alexandre Belloni <alexandre.belloni@bootlin.com> CC: Ludovic Desroches <ludovic.desroches@microchip.com> CC: linux-arm-kernel@lists.infradead.org CC: linux-usb@vger.kernel.org Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: atmel: support USB suspendJonas Bonn2019-05-032-6/+50
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds support for USB suspend to the Atmel UDC. When suspended, the UDC clock can be stopped, resulting in some power savings. The "wake up" interrupt will fire irregardless of whether the clock is running or not, allowing the UDC clock to be restarted when the USB master wants to wake the device again. The IRQ state of this device is somewhat fiddly. The "wake up" IRQ seems to actually be a "bus activity" indicator; the IRQ is almost continuously asserted so enabling this IRQ should only be done after a suspend when the wake IRQ becomes relevant. Similarly, the "suspend" IRQ detects "bus inactivity" and may therefore fire together with a "wake" if the two types of activity coincide during the period between two IRQ handler invocations; therefore, it's important to ignore the "suspend" IRQ while waiting for a wake-up. This has been tested on a SAMA5D2 board. Signed-off-by: Jonas Bonn <jonas@norrbonn.se> CC: Cristian Birsan <cristian.birsan@microchip.com> CC: Felipe Balbi <balbi@kernel.org> CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org> CC: Nicolas Ferre <nicolas.ferre@microchip.com> CC: Alexandre Belloni <alexandre.belloni@bootlin.com> CC: Ludovic Desroches <ludovic.desroches@microchip.com> CC: linux-arm-kernel@lists.infradead.org CC: linux-usb@vger.kernel.org Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: atmel_usba_udc: simplify setting of interrupt-enabled maskJonas Bonn2019-05-031-10/+19
| | | | | | | | | | | | | | | | | This patch adds set and clear functions for enabling/disabling interrupts. This simplifies the implementation a bit as the masking of previously set bits doesn't need to be so explicit. Signed-off-by: Jonas Bonn <jonas@norrbonn.se> CC: Cristian Birsan <cristian.birsan@microchip.com> CC: Felipe Balbi <balbi@kernel.org> CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org> CC: Nicolas Ferre <nicolas.ferre@microchip.com> CC: Alexandre Belloni <alexandre.belloni@bootlin.com> CC: Ludovic Desroches <ludovic.desroches@microchip.com> CC: linux-arm-kernel@lists.infradead.org CC: linux-usb@vger.kernel.org Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: do not use __constant_cpu_to_le16Sergey Senozhatsky2019-05-031-3/+3
| | | | | | | | | | | | | A trivial patch. cpu_to_le16() is capable enough to detect __builtin_constant_p() and to use an appropriate compile time ___constant_swahbXX() function. So we can use cpu_to_le16() instead of __constant_cpu_to_le16(). Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: introduce usb_ep_type_string() functionChunfeng Yun2019-05-032-20/+2
| | | | | | | | | | | | | | | In some places, the code prints a human-readable USB endpoint transfer type (e.g. "bulk"). This involves a switch statement sometimes wrapped around in ({ ... }) block leading to code repetition. To make this scenario easier, here introduces usb_ep_type_string() function, which returns a human-readable name of provided endpoint type. It also changes a few places switch was used to use this new function. Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: udc: lpc32xx: rework interrupt handlingAlexandre Belloni2019-05-031-19/+10
| | | | | | | | There is no actual need to do the enable/disable_irq dance. Instead enable the interrupts on the phy only when necessary. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: udc: lpc32xx: add support for stotg04 phyAlexandre Belloni2019-05-031-5/+27
| | | | | | | | | The STOTG04 phy is used as a drop-in replacement of the ISP1301 but some bits doesn't have exactly the same meaning and this can lead to issues. Detect the phy dynamically and avoid writing to reserved bits. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: udc: lpc32xx: properly setup phy interruptsAlexandre Belloni2019-05-031-2/+2
| | | | | | | | | Only INT_VBUS_VLD is set to generate ATX interrupts on the phy but INT_SESS_VLD is checked in vbus_work. This leads to cases where hot-plugging USB doesn't work after boot. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: udc: lpc32xx: simplify vbus handlingAlexandre Belloni2019-05-031-11/+6
| | | | | | | | Use a threaded IRQ to handle vbus_work instead of using the global worqueue. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: udc: lpc32xx: simplify probeAlexandre Belloni2019-05-031-68/+25
| | | | | | | Simplify .probe and .remove by using devm managed allocations and requests. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* USB: UDC: net22{80,72}: remove mistaken test of req->zeroAlan Stern2019-05-032-4/+2
| | | | | | | | | | | | | | | | The net2280 UDC driver (and also net2272, probably via copy-and-paste) incorrectly checks the req->zero flag during OUT transfers, after copying data from the UDC's FIFO into memory. This makes no sense at all; the "zero" flag indicates that an extra zero-length packet should be appended to an IN transfer if the length is an even multiple of the maxpacket size. It has nothing to do with OUT transfers. In practice this doesn't cause any problems because gadget drivers never set req->zero for OUT transfers anyway. Still, it is an error and unnecessary code, so this patch removes the check. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* USB: UDC: net2280: Remove redundant "if" conditionAlan Stern2019-05-031-1/+1
| | | | | | | | | | | | The net2280 driver includes an unnecessary test for an endpoint's queue being empty. The test is redundant; it sits inside a conditional block of an "if" statement which already tests the endpoint's queue. This patch removes the redundant test. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: f_ncm: Add OS descriptor supportRomain Izard2019-05-032-3/+47
| | | | | | | | | | | | | To be able to use the default USB class drivers available in Microsoft Windows, we need to add OS descriptors to the exported USB gadget to tell the OS that we are compatible with the built-in drivers. Copy the OS descriptor support from f_rndis into f_ncm. As a result, using the WINNCM compatible ID, the UsbNcm driver is loaded on enumeration without the need for a custom driver or inf file. Signed-off-by: Romain Izard <romain.izard.pro@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: f_ncm: Fix NTP-32 supportRomain Izard2019-05-031-7/+3
| | | | | | | | | | | | When connecting a CDC-NCM gadget to an host that uses the NTP-32 mode, or that relies on the default CRC setting, the current implementation gets confused, and does not expect the correct signature for its packets. Fix this, by ensuring that the ndp_sign member in the f_ncm structure always contain a valid value. Signed-off-by: Romain Izard <romain.izard.pro@gmail.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* USB: dummy-hcd: Fix failure to give back unlinked URBsAlan Stern2019-05-031-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The syzkaller USB fuzzer identified a failure mode in which dummy-hcd would never give back an unlinked URB. This causes usb_kill_urb() to hang, leading to WARNINGs and unkillable threads. In dummy-hcd, all URBs are given back by the dummy_timer() routine as it scans through the list of pending URBS. Failure to give back URBs can be caused by failure to start or early exit from the scanning loop. The code currently has two such pathways: One is triggered when an unsupported bus transfer speed is encountered, and the other by exhausting the simulated bandwidth for USB transfers during a frame. This patch removes those two paths, thereby allowing all unlinked URBs to be given back in a timely manner. It adds a check for the bus speed when the gadget first starts running, so that dummy_timer() will never thereafter encounter an unsupported speed. And it prevents the loop from exiting as soon as the total bandwidth has been used up (the scanning loop continues, giving back unlinked URBs as they are found, but not transferring any more data). Thanks to Andrey Konovalov for manually running the syzkaller fuzzer to help track down the source of the bug. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Reported-and-tested-by: syzbot+d919b0f29d7b5a4994b9@syzkaller.appspotmail.com CC: <stable@vger.kernel.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: f_fs: don't free buffer prematurelyFei Yang2019-05-031-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following kernel panic happens due to the io_data buffer gets deallocated before the async io is completed. Add a check for the case where io_data buffer should be deallocated by ffs_user_copy_worker. [ 41.663334] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048 [ 41.672099] #PF error: [normal kernel read fault] [ 41.677356] PGD 20c974067 P4D 20c974067 PUD 20c973067 PMD 0 [ 41.683687] Oops: 0000 [#1] PREEMPT SMP [ 41.687976] CPU: 1 PID: 7 Comm: kworker/u8:0 Tainted: G U 5.0.0-quilt-2e5dc0ac-00790-gd8c79f2-dirty #2 [ 41.705309] Workqueue: adb ffs_user_copy_worker [ 41.705316] RIP: 0010:__vunmap+0x2a/0xc0 [ 41.705318] Code: 0f 1f 44 00 00 48 85 ff 0f 84 87 00 00 00 55 f7 c7 ff 0f 00 00 48 89 e5 41 55 41 89 f5 41 54 53 48 89 fb 75 71 e8 56 d7 ff ff <4c> 8b 60 48 4d 85 e4 74 76 48 89 df e8 25 ff ff ff 45 85 ed 74 46 [ 41.705320] RSP: 0018:ffffbc3a40053df0 EFLAGS: 00010286 [ 41.705322] RAX: 0000000000000000 RBX: ffffbc3a406f1000 RCX: 0000000000000000 [ 41.705323] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff [ 41.705324] RBP: ffffbc3a40053e08 R08: 000000000001fb79 R09: 0000000000000037 [ 41.705325] R10: ffffbc3a40053b68 R11: ffffbc3a40053cad R12: fffffffffffffff2 [ 41.705326] R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffffffffff [ 41.705328] FS: 0000000000000000(0000) GS:ffff9e2977a80000(0000) knlGS:0000000000000000 [ 41.705329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.705330] CR2: 0000000000000048 CR3: 000000020c994000 CR4: 00000000003406e0 [ 41.705331] Call Trace: [ 41.705338] vfree+0x50/0xb0 [ 41.705341] ffs_user_copy_worker+0xe9/0x1c0 [ 41.705344] process_one_work+0x19f/0x3e0 [ 41.705348] worker_thread+0x3f/0x3b0 [ 41.829766] kthread+0x12b/0x150 [ 41.833371] ? process_one_work+0x3e0/0x3e0 [ 41.838045] ? kthread_create_worker_on_cpu+0x70/0x70 [ 41.843695] ret_from_fork+0x3a/0x50 [ 41.847689] Modules linked in: hci_uart bluetooth ecdh_generic rfkill_gpio dwc3_pci dwc3 snd_usb_audio mei_me tpm_crb snd_usbmidi_lib xhci_pci xhci_hcd mei tpm snd_hwdep cfg80211 snd_soc_skl snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_hda_ext_core snd_hda_core videobuf2_dma_sg crlmodule [ 41.876880] CR2: 0000000000000048 [ 41.880584] ---[ end trace 2bc4addff0f2e673 ]--- [ 41.891346] RIP: 0010:__vunmap+0x2a/0xc0 [ 41.895734] Code: 0f 1f 44 00 00 48 85 ff 0f 84 87 00 00 00 55 f7 c7 ff 0f 00 00 48 89 e5 41 55 41 89 f5 41 54 53 48 89 fb 75 71 e8 56 d7 ff ff <4c> 8b 60 48 4d 85 e4 74 76 48 89 df e8 25 ff ff ff 45 85 ed 74 46 [ 41.916740] RSP: 0018:ffffbc3a40053df0 EFLAGS: 00010286 [ 41.922583] RAX: 0000000000000000 RBX: ffffbc3a406f1000 RCX: 0000000000000000 [ 41.930563] RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff [ 41.938540] RBP: ffffbc3a40053e08 R08: 000000000001fb79 R09: 0000000000000037 [ 41.946520] R10: ffffbc3a40053b68 R11: ffffbc3a40053cad R12: fffffffffffffff2 [ 41.954502] R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffffffffff [ 41.962482] FS: 0000000000000000(0000) GS:ffff9e2977a80000(0000) knlGS:0000000000000000 [ 41.971536] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 41.977960] CR2: 0000000000000048 CR3: 000000020c994000 CR4: 00000000003406e0 [ 41.985930] Kernel panic - not syncing: Fatal exception [ 41.991817] Kernel Offset: 0x16000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 42.009525] Rebooting in 10 seconds.. [ 52.014376] ACPI MEMORY or I/O RESET_REG. Fixes: 772a7a724f69 ("usb: gadget: f_fs: Allow scatter-gather buffers") Signed-off-by: Fei Yang <fei.yang@intel.com> Reviewed-by: Manu Gautam <mgautam@codeaurora.org> Tested-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* USB: gadget: f_hid: fix deadlock in f_hidg_write()Radoslav Gerganov2019-03-201-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | In f_hidg_write() the write_spinlock is acquired before calling usb_ep_queue() which causes a deadlock when dummy_hcd is being used. This is because dummy_queue() callbacks into f_hidg_req_complete() which tries to acquire the same spinlock. This is (part of) the backtrace when the deadlock occurs: 0xffffffffc06b1410 in f_hidg_req_complete 0xffffffffc06a590a in usb_gadget_giveback_request 0xffffffffc06cfff2 in dummy_queue 0xffffffffc06a4b96 in usb_ep_queue 0xffffffffc06b1eb6 in f_hidg_write 0xffffffff8127730b in __vfs_write 0xffffffff812774d1 in vfs_write 0xffffffff81277725 in SYSC_write Fix this by releasing the write_spinlock before calling usb_ep_queue() Reviewed-by: James Bottomley <James.Bottomley@HansenPartnership.com> Tested-by: James Bottomley <James.Bottomley@HansenPartnership.com> Cc: stable@vger.kernel.org # 4.11+ Fixes: 749494b6bdbb ("usb: gadget: f_hid: fix: Move IN request allocation to set_alt()") Signed-off-by: Radoslav Gerganov <rgerganov@vmware.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: net2272: Fix net2272_dequeue()Guido Kiener2019-03-201-0/+1
| | | | | | | | | | | | | | | | | Restore the status of ep->stopped in function net2272_dequeue(). When the given request is not found in the endpoint queue the function returns -EINVAL without restoring the state of ep->stopped. Thus the endpoint keeps blocked and does not transfer any data anymore. This fix is only compile-tested, since we do not have a corresponding hardware. An analogous fix was tested in the sibling driver. See "usb: gadget: net2280: Fix net2280_dequeue()" Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: net2280: Fix net2280_dequeue()Guido Kiener2019-03-201-2/+2
| | | | | | | | | | | | | | | When a request must be dequeued with net2280_dequeue() e.g. due to a device clear action and the same request is finished by the function scan_dma_completions() then the function net2280_dequeue() does not find the request in the following search loop and returns the error -EINVAL without restoring the status ep->stopped. Thus the endpoint keeps blocked and does not receive any data anymore. This fix restores the status and does not issue an error message. Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: net2280: Fix overrun of OUT messagesGuido Kiener2019-03-201-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The OUT endpoint normally blocks (NAK) subsequent packets when a short packet was received and returns an incomplete queue entry to the gadget driver. Thereby the gadget driver can detect a short packet when reading queue entries with a length that is not equal to a multiple of packet size. The start_queue() function enables receiving OUT packets regardless of the content of the OUT FIFO. This results in a race: With the current code, it's possible that the "!ep->is_in && (readl(&ep->regs->ep_stat) & BIT(NAK_OUT_PACKETS))" test in start_dma() will fail, then a short packet will be received, and then start_queue() will call stop_out_naking(). That's what we don't want (OUT naking gets turned off while there is data in the FIFO) because then the next driver request might receive a mixture of old and new packets. With the patch, this race can't occur because the FIFO's state is tested after we know that OUT naking is already turned on, and OUT naking is stopped only when both of the conditions are met. This ensures that all received data is delivered to the gadget driver, which can detect a short packet now before new packets are appended to the last short packet. Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Guido Kiener <guido.kiener@rohde-schwarz.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsiLinus Torvalds2019-03-091-9/+0
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull SCSI updates from James Bottomley: "This is mostly update of the usual drivers: arcmsr, qla2xxx, lpfc, hisi_sas, target/iscsi and target/core. Additionally Christoph refactored gdth as part of the dma changes. The major mid-layer change this time is the removal of bidi commands and with them the whole of the osd/exofs driver and filesystem. This is a major simplification for block and mq in particular" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (240 commits) scsi: cxgb4i: validate tcp sequence number only if chip version <= T5 scsi: cxgb4i: get pf number from lldi->pf scsi: core: replace GFP_ATOMIC with GFP_KERNEL in scsi_scan.c scsi: mpt3sas: Add missing breaks in switch statements scsi: aacraid: Fix missing break in switch statement scsi: kill command serial number scsi: csiostor: drop serial_number usage scsi: mvumi: use request tag instead of serial_number scsi: dpt_i2o: remove serial number usage scsi: st: osst: Remove negative constant left-shifts scsi: ufs-bsg: Allow reading descriptors scsi: ufs: Allow reading descriptor via raw upiu scsi: ufs-bsg: Change the calling convention for write descriptor scsi: ufs: Remove unused device quirks Revert "scsi: ufs: disable vccq if it's not needed by UFS device" scsi: megaraid_sas: Remove a bunch of set but not used variables scsi: clean obsolete return values of eh_timed_out scsi: sd: Optimal I/O size should be a multiple of physical block size scsi: MAINTAINERS: SCSI initiator and target tweaks scsi: fcoe: make use of fip_mode enum complete ...
| * scsi: target/core: Remove the write_pending_status() callback functionBart Van Assche2019-02-041-9/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to the patch that makes TMF handling synchronous the write_pending_status() callback function is no longer called. Hence remove it. Acked-by: Felipe Balbi <balbi@ti.com> Reviewed-by: Sagi Grimberg <sagig@mellanox.com> Reviewed-by: Andy Grover <agrover@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Hannes Reinecke <hare@suse.com> Reviewed-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com> Cc: Nicholas Bellinger <nab@linux-iscsi.org> Cc: Mike Christie <mchristi@redhat.com> Cc: Himanshu Madhani <himanshu.madhani@qlogic.com> Cc: Quinn Tran <quinn.tran@qlogic.com> Cc: Saurav Kashyap <saurav.kashyap@qlogic.com> Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Juergen Gross <jgross@suse.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
* | Merge tag 'pci-v5.1-changes' of ↵Linus Torvalds2019-03-091-1/+0
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci Pull PCI updates from Bjorn Helgaas: - Use match_string() instead of reimplementing it (Andy Shevchenko) - Enable SERR# forwarding for all bridges (Bharat Kumar Gogada) - Use Latency Tolerance Reporting if already enabled by platform (Bjorn Helgaas) - Save/restore LTR info for suspend/resume (Bjorn Helgaas) - Fix DPC use of uninitialized data (Dongdong Liu) - Probe bridge window attributes only once at enumeration-time to fix device accesses during rescan (Bjorn Helgaas) - Return BAR size (not "size -1 ") from pci_size() to simplify code (Du Changbin) - Use config header type (not class code) identify bridges more reliably (Honghui Zhang) - Work around Intel Denverton incorrect Trace Hub BAR size reporting (Alexander Shishkin) - Reorder pciehp cached state/hardware state updates to avoid missed interrupts (Mika Westerberg) - Turn ibmphp semaphores into completions or mutexes (Arnd Bergmann) - Mark expected switch fall-through (Mathieu Malaterre) - Use of_node_name_eq() for node name comparisons (Rob Herring) - Add ACS and pciehp quirks for HXT SD4800 (Shunyong Yang) - Consolidate Rohm Vendor ID definitions (Andy Shevchenko) - Use u32 (not __u32) for things not exposed to userspace (Logan Gunthorpe) - Fix locking semantics of bus and slot reset interfaces (Alex Williamson) - Update PCIEPORTBUS Kconfig help text (Hou Zhiqiang) - Allow portdrv to claim subtractive decode Ports so PCIe services will work for them (Honghui Zhang) - Report PCIe links that become degraded at run-time (Alexandru Gagniuc) - Blacklist Gigabyte X299 Root Port power management to fix Thunderbolt hotplug (Mika Westerberg) - Revert runtime PM suspend/resume callbacks that broke PME on network cable plug (Mika Westerberg) - Disable Data Link State Changed interrupts to prevent wakeup immediately after suspend (Mika Westerberg) - Extend altera to support Stratix 10 (Ley Foon Tan) - Allow building altera driver on ARM64 (Ley Foon Tan) - Replace Douglas with Tom Joseph as Cadence PCI host/endpoint maintainer (Lorenzo Pieralisi) - Add DT support for R-Car RZ/G2E (R8A774C0) (Fabrizio Castro) - Add dra72x/dra74x/dra76x SoC compatible strings (Kishon Vijay Abraham I) - Enable x2 mode support for dra72x/dra74x/dra76x SoC (Kishon Vijay Abraham I) - Configure dra7xx PHY to PCIe mode (Kishon Vijay Abraham I) - Simplify dwc (remove unnecessary header includes, name variables consistently, reduce inverted logic, etc) (Gustavo Pimentel) - Add i.MX8MQ support (Andrey Smirnov) - Add message to help debug dwc MSI-X mask bit errors (Gustavo Pimentel) - Work around imx7d PCIe PLL erratum (Trent Piepho) - Don't assert qcom reset GPIO during probe (Bjorn Andersson) - Skip dwc MSI init if MSIs have been disabled (Lucas Stach) - Use memcpy_fromio()/memcpy_toio() instead of plain memcpy() in PCI endpoint framework (Wen Yang) - Add interface to discover supported endpoint features to replace a bitfield that wasn't flexible enough (Kishon Vijay Abraham I) - Implement the new supported-feature interface for designware-plat, dra7xx, rockchip, cadence (Kishon Vijay Abraham I) - Fix issues with 64-bit BAR in endpoints (Kishon Vijay Abraham I) - Add layerscape endpoint mode support (Xiaowei Bao) - Remove duplicate struct hv_vp_set in favor of struct hv_vpset (Maya Nakamura) - Rework hv_irq_unmask() to use cpumask_to_vpset() instead of open-coded reimplementation (Maya Nakamura) - Align Hyper-V struct retarget_msi_interrupt arguments (Maya Nakamura) - Fix mediatek MMIO size computation to enable full size of available MMIO space (Honghui Zhang) - Fix mediatek DMA window size computation to allow endpoint DMA access to full DRAM address range (Honghui Zhang) - Fix mvebu prefetchable BAR regression caused by common bridge emulation that assumed all bridges had prefetchable windows (Thomas Petazzoni) - Make advk_pci_bridge_emul_ops static (Wei Yongjun) - Configure MPS settings for VMD root ports (Jon Derrick) * tag 'pci-v5.1-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (92 commits) PCI: Update PCIEPORTBUS Kconfig help text PCI: Fix "try" semantics of bus and slot reset PCI/LINK: Report degraded links via link bandwidth notification dt-bindings: PCI: altera: Add altr,pcie-root-port-2.0 PCI: altera: Enable driver on ARM64 PCI: altera: Add Stratix 10 PCIe support PCI/PME: Fix possible use-after-free on remove PCI: aardvark: Make symbol 'advk_pci_bridge_emul_ops' static PCI: dwc: skip MSI init if MSIs have been explicitly disabled PCI: hv: Refactor hv_irq_unmask() to use cpumask_to_vpset() PCI: hv: Replace hv_vp_set with hv_vpset PCI: hv: Add __aligned(8) to struct retarget_msi_interrupt PCI: mediatek: Enlarge PCIe2AHB window size to support 4GB DRAM PCI: mediatek: Fix memory mapped IO range size computation PCI: dwc: Remove superfluous shifting in definitions PCI: dwc: Make use of GENMASK/FIELD_PREP PCI: dwc: Make use of BIT() in constant definitions PCI: dwc: Share code for dw_pcie_rd/wr_other_conf() PCI: dwc: Make use of IS_ALIGNED() PCI: imx6: Add code to request/control "pcie_aux" clock for i.MX8MQ ...
| * | PCI: Move Rohm Vendor ID to generic listAndy Shevchenko2019-02-011-1/+0
| |/ | | | | | | | | | | | | | | | | Move the Rohm Vendor ID to pci_ids.h instead of defining it in several drivers. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Mark Brown <broonie@kernel.org> Acked-by: Linus Walleij <linus.walleij@linaro.org>
* | Merge tag 'usb-for-v5.1' of ↵Greg Kroah-Hartman2019-02-1532-107/+116
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next Felipe writes: USB: changes for v5.1 merge window Dwc3 now works on TI's AM6xx platforms. Also on dwc3 we have a few changes which improve request cancellation and some improvements to how we print to the trace buffer. Renesas_usb3 got support for r8a774c0 device. Dwc2 got scatter-gather support. Apart from these, the usual set of minor fixes and all sorts of small details. * tag 'usb-for-v5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (40 commits) usb: phy: twl6030-usb: fix possible use-after-free on remove usb: misc: usbtest: add super-speed isoc support usb: dwc3: Reset num_trbs after skipping usb: dwc3: gadget: don't enable interrupt when disabling endpoint fotg210-udc: pass struct device to DMA API functions fotg210-udc: remove a bogus dma_sync_single_for_device call usb: gadget: Change Andrzej Pietrasiewicz's e-mail address usb: f_fs: Avoid crash due to out-of-scope stack ptr access usb: dwc3: haps: Workaround matching VID PID usb: gadget: f_fs: preserve wMaxPacketSize across usb_ep_autoconfig() call usb: gadget: move non-super speed code out of usb_ep_autoconfig_ss() usb: gadget: function: sync f_uac1 ac header baInterfaceNr usb: dwc2: gadget: Add scatter-gather mode usb: gadget: fix various indentation issues usb: dwc2: Fix EP TxFIFO number setting udc: net2280: Fix net2280_disable USB: gadget: Improve kerneldoc for usb_ep_dequeue() usb: dwc3: debug: purge usage of strcat usb: dwc3: trace: pass trace buffer size to decoding functions usb: dwc3: gadget: remove DWC3_EP_END_TRANSFER_PENDING ...
| * | fotg210-udc: pass struct device to DMA API functionsChristoph Hellwig2019-02-111-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | The DMA API generally relies on a struct device to work properly, and only barely works without one for legacy reasons. Pass the easily available struct device from the platform_device to remedy this. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| * | fotg210-udc: remove a bogus dma_sync_single_for_device callChristoph Hellwig2019-02-111-4/+0
| | | | | | | | | | | | | | | | | | | | | dma_map_single already transfers ownership to the device. Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| * | usb: gadget: Change Andrzej Pietrasiewicz's e-mail addressAndrzej Pietrasiewicz2019-02-1119-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | My @samusung.com address is going to cease existing soon, so change it to an address which can actually be used to contact me. Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
| * | usb: f_fs: Avoid crash due to out-of-scope stack ptr accessJohn Stultz2019-02-111-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the 5.0 merge window opened, I've been seeing frequent crashes on suspend and reboot with the trace: [ 36.911170] Unable to handle kernel paging request at virtual address ffffff801153d660 [ 36.912769] Unable to handle kernel paging request at virtual address ffffff800004b564 ... [ 36.950666] Call trace: [ 36.950670] queued_spin_lock_slowpath+0x1cc/0x2c8 [ 36.950681] _raw_spin_lock_irqsave+0x64/0x78 [ 36.950692] complete+0x28/0x70 [ 36.950703] ffs_epfile_io_complete+0x3c/0x50 [ 36.950713] usb_gadget_giveback_request+0x34/0x108 [ 36.950721] dwc3_gadget_giveback+0x50/0x68 [ 36.950723] dwc3_thread_interrupt+0x358/0x1488 [ 36.950731] irq_thread_fn+0x30/0x88 [ 36.950734] irq_thread+0x114/0x1b0 [ 36.950739] kthread+0x104/0x130 [ 36.950747] ret_from_fork+0x10/0x1c I isolated this down to in ffs_epfile_io(): https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/usb/gadget/function/f_fs.c#n1065 Where the completion done is setup on the stack: DECLARE_COMPLETION_ONSTACK(done); Then later we setup a request and queue it, and wait for it: if (unlikely(wait_for_completion_interruptible(&done))) { /* * To avoid race condition with ffs_epfile_io_complete, * dequeue the request first then check * status. usb_ep_dequeue API should guarantee no race * condition with req->complete callback. */ usb_ep_dequeue(ep->ep, req); interrupted = ep->status < 0; } The problem is, that we end up being interrupted, dequeue the request, and exit. But then the irq triggers and we try calling complete() on the context pointer which points to now random stack space, which results in the panic. Alan Stern pointed out there is a bug here, in that the snippet above "assumes that usb_ep_dequeue() waits until the request has been completed." And that: wait_for_completion(&done); Is needed right after the usb_ep_dequeue(). Thus this patch implements that change. With it I no longer see the crashes on suspend or reboot. This issue seems to have been uncovered by behavioral changes in the dwc3 driver in commit fec9095bdef4e ("usb: dwc3: gadget: remove wait_end_transfer"). Cc: Alan Stern <stern@rowland.harvard.edu> Cc: Felipe Balbi <balbi@kernel.org> Cc: Zeng Tao <prime.zeng@hisilicon.com> Cc: Jack Pham <jackp@codeaurora.org> Cc: Thinh Nguyen <thinh.nguyen@synopsys.com> Cc: Chen Yu <chenyu56@huawei.com> Cc: Jerry Zhang <zhangjerry@google.com> Cc: Lars-Peter Clausen <lars@metafoo.de> Cc: Vincent Pelletier <plr.vincent@gmail.com> Cc: Andrzej Pietrasiewicz <andrzej.p@samsung.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Linux USB List <linux-usb@vger.kernel.org> Suggested-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-14 18:25:09 +0000